Chrome Enhanced Protection now flags malicious CopyFix scam commands

Google is updating Chrome’s Enhanced Protection mode to detect scam websites that trick users into copying malicious commands. The company announced this change to help users avoid ClickFix scams, where attackers pose as fixers for fake problems. This update aims to provide earlier warnings before users execute harmful instructions on their devices.

The new capability specifically targets pages that instruct users to copy and run commands to resolve non-existent issues. According to Help Net Security, Google introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to combat online scams and social engineering. The company states that users of this mode are ten times safer from phishing and other scams than those using Standard Protection, based on average warning frequencies.

How the detection works

Google has shifted Chrome’s Gemini-powered scam detection from an on-device model to a server-side model for Enhanced Protection users. This change allows the system to analyze page content for indicators such as brand representation, page intent, and scam likelihood. Safe Browsing combines this Gemini analysis with domain reputation and other security signals to determine if a site is malicious.

The company clarified that page text is sent for analysis only when a site displays high-confidence scam indicators. Google stated that this content is processed without being logged, retained, or used to train models. This approach balances detection accuracy with user privacy concerns regarding data sent to external servers.

Types of scams targeted

The updated feature now checks for fake antivirus and browser update scams in addition to traditional tech support scams. ClickFix scams are particularly dangerous because the command users copy can differ from the one displayed on the screen. These commands often invoke living-off-the-land binaries, which are legitimate tools preinstalled on operating systems.

Attackers repurpose these trusted executables, such as PowerShell and cmd.exe, to download and install malware. By using legitimate system tools, attackers can conceal their activity and exploit the trust security software places in these binaries. This makes detection difficult for traditional security solutions that whitelist common system utilities.

Warning interface changes

Chrome uses two types of warnings to alert users to threats. Suspicious site warnings appear when a page displays deceptive patterns associated with known malicious sites. These alerts use tailored formats, icons, colors, and text to help users decide how to proceed. Jasika Bawa, Group Product Manager for Chrome, explained that tailoring the warning UI allows Google to safely expand coverage and display more protective warnings.

Dangerous site warnings appear when a page is known to be malicious and poses a high risk of harm. These alerts continue to use Chrome’s full-page red warning screen. The distinction helps users differentiate between potentially deceptive pages and those confirmed to cause immediate harm, guiding their response accordingly.

What should you do?

Users should ensure their Chrome browsers are updated to the latest version to benefit from these Enhanced Protection improvements. It is also advisable to enable Enhanced Protection mode in Chrome settings if not already active, as it provides stronger defenses against social engineering. Users should remain cautious of any website prompting them to copy and paste commands into their terminal or command prompt.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: Google

• Verify that your Chrome browser is updated to the latest version to receive the new scam detection capabilities.
• Enable Enhanced Protection mode in Chrome settings to access server-side Gemini-powered scam analysis and stricter filtering.
• Avoid copying and pasting commands from websites into your command prompt or terminal, especially if prompted by unexpected error messages.
• Check your browser’s security settings regularly to ensure you are not using Standard Protection, which offers fewer safeguards against social engineering.

Step-by-step guide: Fake Antivirus Warning Signs: How to Spot and Remove Rogue Security Software

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Chrome log the text from websites it analyzes for scams?

No, Google states that page content is processed without being logged, retained, or used to train models.

What is a ClickFix scam?

It is a scam where users are tricked into copying and running a malicious command to fix a fake problem on their computer.

What types of scams does the new detection cover?

The update covers tech support scams, fake antivirus scams, and fake browser update scams.